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Abstract — In our previous work ('An Algebraic Watchdog for 
Wireless Network Coding'), we proposed a new scheme in which 
nodes can detect malicious behaviors probabilistically, police their 
downstream neighbors locally using overheard messages; thus, 
provide a secure global self-checking network. As the first building 
block of such a system, we focused on a two-hop network, 
and presented a graphical model to understand the inference 
process by which nodes police their downstream neighbors and 
to compute the probabilities of misdetection and false detection. 

In this paper, we extend the Algebraic Watchdog to a more 
general network setting, and propose a protocol in which we 
can establish trust in coded systems in a distributed manner. 
We develop a graphical model to detect the presence of an 
adversarial node downstream within a general two-hop network. 
The structure of the graphical model (a trellis) lends itself 
to well-known algorithms, such as Viterbi algorithm, that can 
compute the probabilities of misdetection and false detection. 
Using this as a building block, we generalize our scheme to 
multi-hop networks. We show analytically that as long as the 
min-cut is not dominated by the Byzantine adversaries, upstream 
nodes can monitor downstream neighbors and allow reliable 
communication with certain probability. Finally, we present 
preliminary simulation results that support our analysis. 

I. Introduction 

We consider the problem of Byzantine detection in a coded 
wireless network. Previous work on Byzantine detection fo- 
cused on receiver-based protocols, in which the destination 
nodes of the corrupted data detects the presence of an adver- 
sary upstream. However, this detection may come too late as 
the adversary is partially successful in disrupting the network 
(even if it is detected). It has wasted network bandwidth, while 
the source is still unaware of the need for retransmission. 

In our previous work ||T|, we proposed a new scheme 
called the algebraic watchdog, in which nodes can detect 
malicious behaviors probabilistically by taking advantage of 
the broadcast nature of the wireless medium. The algebraic 
watchdog was inspired by the an analogous protocol for 
routing wireless networks, called the watchdog and pathrater 
(|2l . The key difference between the our previous work 1 1 1 and 
that of ||2l is that we allow network coding. Network coding 
llSJlD is advantageous as it increases throughput, is robust 
against failures/erasures, and is resilient in dynamic networks. 

The key challenge in algebraic watchdog is that, by incor- 
porating network coding, we can no longer recognize packets 
individually. In [2!, a node v can monitor its downstream 
neighbor v' by checking that the packet transmitted by v' is 
a copy of what v transmitted to v' . However, with network 
coding, this is no longer possible as transmitted packets are a 
function of the received packets. Furthermore, v may not have 



full information regarding the packets received at v'; thus, 
node V is faced with the challenge of inferring the packets 
received at v' and ensuring that v' is transmitting a valid 
function of the received packets. We note that |5| combines 
source coding with watchdog; thus, |5| does not face the same 
problem as that of algebraic watchdog. 

II. Problem Statement 

We use elements from a field, and their bit-representation. 
We use the same character in italic font {i.e. x) for the field 
element, in bold font (i.e. x) for the bit-representation, and 
in underscore bold font {i.e. x) for vectors. For arithmetic 
operations in the field, we shall use the conventional notation 
{i.e. +, — , •)■ For bit-wise addition, we use ©. 

The problem statement for this paper is similar to that 
in our previous work |1|. A wireless network is modeled 
using a directed graph G = {V,Ei,E2), where V is the 
set of network nodes, Ei the set of intended transmissions, 
and £'2 the set of interference channels. If {vi,Vj) e Ei 
and {vi,Vk) G £'2 where Vi,Vj,Vk G V, then there is an 
intended transmission from Vi to Vj, and Vk can overhear 
this transmission with noise (modeled using binary symmetric 
channel BSC{pik))- Node Vi E V transmits a coded packet 
Pi, where pi = [ai , hjj , hxj , Xi] is a {0, l}-vector. A vahd 
packet Pi is defined as below: 

• ai corresponds to the coding coefficients aj, j E It, 
where /^ C V^ is the set of nodes adjacent to Vi in Ei, 

• hij corresponds to the hash h{xj), Vj G h where h{-) is 
a (5-bit polynomial hash function, 

• hxj corresponds to the polynomial hash h{xi), 

• Xi is the n-bit representation of xi = X^ie/ ^j^j- 

The pay load Xi is coded with a {n, fci)-code Ci with 
minimum distance dt. Code Ci is an error-correcting code of 
rate Ri = — = 1 — — , and is tailored for the forward commu- 
nication. For instance, vi uses code Ci, chosen appropriately 
for the channel (ui,Wj) G £1, to transmit the pay load xi. 

We assume that the pay load Xi is n-bits, and the hash h{-) is 
(5-bits. We assume that the hash function used, h{-), is known 
to all nodes, including the adversary. In addition, we assume 
that ai, hi. and hx; are part of the header information, and are 
sufficiently coded to allow the nodes to correctly receive them 
even under noisy channel conditions. Note that the hashes 
hi; and hxj are contained within one hop, and the overhead 
associated with the hashes is proportional to the in-degree of 
a node, and does not accumulate with the routing path length. 
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Fig. 1: A small neighborhood of a wireless network with vi. 

Assume that Vi transmits pi = [ai, hij, hxj, Xj], where Xj — 
Xi©e, e G {0, 1}". If Vi is misbehaving, then e ^ 0. Our goal 
is to probabilistically detect when e ^ 0. Note that even if |e| 
is small {i.e. small Hamming distance between Xj and Xi), the 
algebraic interpretation of Xi and Xi may differ significantly. 

A. Threat Model 

We assume powerful adversaries, who can eavesdrop its 
neighbor's transmissions, has the power to inject or corrupt 
packets, and are computationally unbounded. However, the 
adversary does not know the specific realization of the random 
errors introduced by the channels. The adversaries' objective 
is to corrupt the information flow without being detected by 
other nodes. Thus, the adversary will find Xi that will allow 
its misbehavior to be undetected, if there is any such Xi. 

Our goal is to detect probabilistically a malicious behavior 
that is beyond the channel noise, represented by BSC{pik)- 
Note that the algebraic watchdog does not completely elim- 
inate errors introduced by the adversaries; its objective is to 
limit the errors introduced by the adversaries to be at most 
that of the channel. Channel errors (or those introduced by 
adversaries below the channel noise level) can be corrected 
using appropriate error correction schemes, which will be 
necessary even without Byzantine adversaries in the network. 

The notion that adversarial errors should sometimes be 
treated as channel noise has been introduced previously in 
||6l. Under heavy attack, attacks should be treated with special 
attention; while under light attack, the attacks can be treated 
as noise and corrected using error-correction schemes. The 
results in this paper partially reiterate this idea. 

III. Algebraic Watchdog for Two-hop network 

Consider a small neighborhood of nodes in G with nodes 
vi,V2,..-Vjn, Vjn+u Vm+2- Nodes Vi, i £ [1,™], Want to 
transmit Xi to w„i+2 via Wm+i- Without complete information 
about all the messages, we cannot verify whether Vm+i 
is misbehaving or not with certainty. However, there is a 
large overhead associated with acquiring complete informa- 
tion. Therefore, we take advantage of the wireless setting, 
in which nodes can overhear their neighbors' transmission 
(as shown in Figure [U, to probabilistically detect malicious 
behavior Each node checks whether its downstream neighbors 
are transmitting values that are consistent with the gathered 
information. If a node detects that its downstream neighbor is 
misbehaving, it can alert other nodes within the network. 

The graphical model illustrates the inference process a 
node executes to check its next hop node. Without loss of 



generality, we consider the problem from ui's perspective. 
Denote Xi to be the noisy message vi overhears from node u/s 
transmission, for any i G [2, m]. Since the header is protected, 
vi correctly decodes h{xi) and ai for all i G [l,77i]. 

A. Transition matrix 

We define a transition matrix Ti to be a 2"'^^^^^"^))+'^ x 
2n(i-ff(-^)) jjjafj-jx, where H{-) is the entropy function. 

ra(|p£), if h{y)^h{x,) 



Ttix,,y) 



0, 



otherwise 



A/'= ^ Pz{S:i,y), 

{y\hiy)=h{xi)} 

where A(x, y) gives the Hamming distance between code- 
words X and y. In other words, vi computes Xi — {x\h{x) — 
h{xi)} to be the fist of candidates of Xi. For any overheard 
pair [xi, h(xi)], there are multiple candidates of Xi (i.e. \Xi\) 
although the probabilities associated with each inferred Xi are 
different. This is because there are uncertainties associated 
with the wireless medium, represented by BSC{pii). 

For each x G Xi, pi{xi,x) gives the probability of x being 
the original codeword sent by node Vi given that vi overheard 
Xi under BSC{pii). Since we are only considering x G Xi, 
we normalize the probabilities using TV to get the transition 
probability Ti{xi, x). Note Ti{xi, y) — if h{y) ^ h{xi). 

The structure of Ti heavily depends on the collisions of 
the hash function h{-) in use. Note that the structure of Ti 
is independent of i, and therefore, a single transition matrix 
T can be precomputed for all i G [l,m] given the hash 
function h{-). A graphical representation of T is shown in 
Figure |2^. For simplicity of notation, we represent T as a 
matrix; however, the transition probabilities can be computed 
efficiently using hash collision lists as well. 

B. Watchdog trellis 

Node vi uses the information gathered to generate a trellis, 
which is used to infer the valid linear combination that 
w„i+i should transmit to Uto+2. As shown in Figure |2j), the 
trellis has m layers: each layer may contain up to 2" states, 
each representing the inferred linear combination so far For 
example. Layer i consist of all possible values of ^*^j^ OLj^j- 

The matrices Ti,i G [2, to], defines the connectivity of the 
trellis. Let si and S2 be states in Layer i — 1 and Layer i, 
respectively. Then, an edge (si, S2) exists if and only if 

3 X such that si + a^x = S2, Ti{xi,x) ^ 0. 

We denote We(', •) to be the edge weight, where We{si, S2) = 
Ti{xi,x) if edge (si,S2) exists, and zero otherwise. 

C. Viterbi-like algorithm 

We denote w{s,i) to be the weight of state s in Layer i. 
Node vi selects a start state in Layer 1 corresponding to aixi, 
as shown in Figure |2] The weight of Layer 1 state is w{s,l) = 
1 if s = aixi, zero otherwise. For the subsequent layers. 
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(a) Transition matrix T-(Xj,xJ (b) Trellis for Algebraic Watchdog (c) Inverse transition matrix r-'fx„,^j, x,,,^.^) 

Fig. 2: Graphical representation of the inference process at node vi. In the trellis, the transition probability from Layer i — 1 
to Layer i is given by Ti{xi, Xi), which is shown in (a). 



multiple paths can lead to a given state, and the algorithm 
keeps the aggregate probability of reaching that state. To be 
more precise, w{s,i) is: 

w{s,i) — 2. w{s' ,i — 1) ■ We{s' ,s). 

Vs'f^ Layer i — 1 

By definition, w{s, i) is equal to the total probability of 
s = jy.j^i ctjXj given the overheard information. Therefore, 
w(s, m) gives the probability that s is the valid linear com- 
bination that v,n+i should transmit to Um+2- It is important 
note that 'w{s, ra) is dependent on the channel statistics, 
as well as the overheard information. For some states s, 
'w{s, ra) = 0, which indicates that state s can not be a valid 
linear combination; only those states s with w{s,m) > are 
the inferred candidate linear combinations. 

Note that the algorithm introduced above is a dynamic 
program, and is similar to the Viterbi algorithm. Therefore, 
tools developed for dynamic programming/Viterbi algorithm 
can be used to compute the probabilities efficiently. 

D. Decision making 

Node vi computes the probability that the overheard i„i+i 
and h{xm^i) are consistent with the inferred w{-,m) to make 
a decision regarding Um+i's behavior To do so, vi constructs 
an inverse transition matrix T^^, which is a 2"'(^ ^^^^ x 
2"(i s^)+'^ matrix whose elements are defined as follows: 

T-\y,im+i)-^ ^ 



0, 



if h{y) = h{x,n+i) 
otherwise 



M= ^ p„,+i{xm+i,y)- 

{y\Hy)=h(xm+i)} 

Unlike T introduced in Section UlI-AI T^^{x^Xm+i) gives 
the probability of overhearing [xm+i, /i(x,n+i)] given that 
X G {y\h{y) — h{xm+i)} is the original codeword sent by 
Vjn+i and the channel statistics. Note that T^^ is identical 
to T except for the normalizing factor M.. A graphical 
representation of T^^ is shown in Figure |2};. 

In Figure |2};, si and S3 are the inferred candidate linear 
combinations, i.e. w{si,m) ^ and w{s2,m) ^ 0; the 
end node indicates what node vi has overheard from Vm+i. 
Note that although si is one of the inferred linear combina- 
tions, si is not connected to the end node. This is because 



h{si) 7^ h{xm+i). On the other hand, ^.(52) = h{xm+i)', as a 
result, S2 is connected to the end node although w{s2,m) = 0. 
We define an inferred linear combination s as matched if 
'w{s,m) > and h{s) = h{xm+i)- 

Node vi uses T^^ to compute the total probability p* of 
hearing [xm+i, h{xm+i)] given the inferred linear combina- 
tions by computing the following equation: 



P 



^w{s,m) -T ^(s, £,„+i). 



Vs 



Probability p* is the probability of overhearing Xm+i given 
the channel statistics; thus, measures the likelihood that Vm+i 
is consistent with the information gathered by vi. Node vi can 
use p* to make a decision on Wm+i's behavior For example, 
vi can use a threshold decision rule to decide whether Vm+i is 
misbehaving or not: vi claims that Vm+i is malicious if p* <t 
where t is a threshold value determined by the given channel 
statistics; otherwise, vi claims Vm+i is well-behaving. 

Depending on the decision policy used, we can use the 
hypothesis testing framework to analyze the probability of 
false positive and false negative. Reference [1| provides such 
analysis for the simple two-hop network. However, the purpose 
of this paper is not to propose a decision policy, but to propose 
a method in which we can compute p*, which can be used to 
establish trust within a network. We note that it would be 
worthwhile to look into specific decision policies and their 
performance {i.e. false positive/negative probabilities) as in yj. 

IV. Analysis for Two-hop Network 

In this section, we provide an analysis for the performance 
of Algebraic Watchdog for two-hop network. 

Theorem 4.1: Consider a two-hop network as shown in 
Figure [U Consider node Vj, j G [1,"^]- Then, the number 
of matched codewords is: 



,H^. 



^j,i£[l,r, 



,(ff(p.,)-ff(^))-l]-™5 



Proof: Without loss of generality, we consider node 
vi. The proof uses on concepts and techniques developed 
for list-decoding ["71. We first consider the overhearing of 
Wfc's transmission, k G [2,m]. Node vi overhears Xk from 
Vk. The noise introduced by the overhearing channel is 
characterized by BSC{pki)', thus, _E[A(xk,Xk)] = npki. 



Now, we consider the number of codewords that are within 
B{xk, npki), the Hamming ball of radius npki centered at Xk 
is \B{xk,npki)\ = 2"('f^(P"'"^(Tr)). Note that vi overhears 
the hash h{xk)\ thus, the number of codewords that vi consid- 
ers is reduced to 2"'^^'^P'=i^~^("^^)~'^. Using this information, 
vi computes the set of inferred linear combinations, i.e. s 
where ^(s, m) > 0. Note that vi knows precisely the values 
of xi. Therefore, the number of inferred linear combinations 
is upper bounded by: 

J] ('2"(^(^")-^(^))-^'') (1) 

fce[2,m] ^ ^ 

Note that due to the finite field operations, these inferred linear 
combinations are randomly distributed over the space {0,1}". 
Now, we consider the overheard information, Xm+i from 
the downstream node Vm+i- By similar analysis as above, 
we can derive that there are 2"(^(P"+ii)"^(^^))"'' code- 
words in the hamming ball i?(im+i,r7,pm+i,i) with hash 
value h{xm+i)- Thus, the probability that a randomly chosen 
codeword in the space of {0, 1}" is in B{xm+i,npjn+i,i) H 
{x\h{x) = h{xm+i)} is: 



2n(H(p^+i,i)~H(^^))-S 



(3) 



Then, the expected number of matched codewords is the 
product of Equations (|2]l and (O. ■ 

Note that if we assume that the hash is of length 5 = en, 
then the statement in Theorem 14. II is equal to: 



(4) 



E.^,,.e[l,„+lj ff(P..)-(E.^,,e[i,„+ij H(^) + l+r. 



This highlights the tradeoff between the quality of overhearing 
channel and the redundancy (introduced by C/s and the hash 
h). If enough redundancy is introduced, then Ci and h together 
form an error-correcting code for the overhearing channels; 
thus, allows exact decoding to a single matched codeword. 

The analysis also shows how adversarial errors can be inter- 
preted. Assume that Vm+i wants to inject errors at rate Padv 
Then, node vi, although has an overhearing BSC{pm+i,i), 
effectively experiences an error rate of padv + Pm+i.i — 
Padv ■ Pm+1.1- Note that this does not change the set of 
the inferred linear combinations; but it affects im+i- Thus, 
overall, adversarial errors affect the set of matched codewords 
and the distribution of p*. As we shall see in Section IVll the 
difference in distribution of p* between a well-behaving relay 
and adversarial relay can be used to detect malicious behavior 

V. Protocol for Algebraic Watchdog 

In this section, we use the two-hop algebraic watchdog 
from Section |lll] in a hop-by-hop manner to ensure a globally 
secure network. In Algorithm [1] we present a distributed 
algorithm for nodes to secure the their local neighborhood. 
Each node v transmits/receives data as scheduled; however, 
node V randomly chooses to check its neighborhood, at which 



point node v listens to neighbors transmissions to perform the 
two-hop algebraic watchdog from Section |III] 

Corollary 5.1: Consider Vm+i as shown in Figure [T] As- 
sume that the downstream node Vm+2 is well-behaving, and 
thus, forces hx„+i — h{xm+i)- Let pi be the packet received 
by Vm+i from parent node Vi G P{v). Then, if there exists at 
least one well-behaving parent Vj £ P{v), Wm+i cannot inject 
errors beyond the overhearing channel noise (pm+ij) without 
being detected. 

Section |IV] shows that presence of adversarial error (at a 
rate above the channel noise) can be detected by a change in 
distribution of p*. Note that this Corollarv 15 . 1 1 does not make 
any assumptions on whether packets pi's are valid or not. 
Instead, the claim states that Vm+i transmits a valid packet 
given the packets pi it has received. 

Corollary 5.2: Node v can inject errors beyond the channel 
noise only if either of the two conditions are satisfied: 

1) All its parent nodes P{v) ~ {u\{u,v) G Ei} are 
colluding Byzantine nodes; 

2) All its downstream nodes, i.e. receivers of the transmis- 
sion Pi, are colluding Byzantine nodes. 

Remark: Note that, in Case 1) of Corollary 15.21 v is not 
responsible to any well-behaving nodes. Node v can transmit 
any packet without the risk of being detected by any well- 
behaving parent node. However, the min-cut to v is dominated 
by adversaries, and the information flow through v is com- 
pletely compromised - regardless of whether v is malicious or 
not. In Case 2) of the Corollary 15.21 v can generate any hash 
value since its downstream nodes are colluding adversaries. 
Thus, it is not liable to transmit a consistent hash, which 
is necessary for w's parent nodes to monitor v's behavior 
However, note that v is not responsible in delivering any data 
to a well-behaving node. Even if v were well-behaving, it 
cannot reach any well-behaving node without going through 
a malicious node in the next hop. Thus, the information flow 
through V is again completely compromised. 

Therefore, Corollarv 15 .21 shows that algebraic watchdog can 
aid in ensuring correct delivery of data when the following 
assumption holds: for every intermediate node v in the path 
between source to destination, v has at least one well-behaving 
parent and at least one well-behaving child - i.e. there exists 
at least a path of well-behaving nodes. This is not a trivial 
result as we are not only considering a single-path network, 
but also multi-hop, multi-path network. 



foreach node v do 

According to the schedule, transmit and receive data; 
if V decides to check its neighborhood then 
Listen to neighbors' transmissions; 
foreach downstream neighbor v' do 
I Perform Two-hop Algebraic Watchdog on v'; 
end 
end 



end 



Algorithm 1: Distributed algebraic watchdog at v. 



TABLE I: The average and variance of p* with varying Padv 
We set m = 3, n = 10, S ~ 2, and ps ~ Pm+i,i = 10%. 



TABLE IIL The average and variance of p* with varying ps 

We set m ^ 3, n — 10, S ~ 2, and padv — 10%. 



Padv 


^adv 


■varadv 


^relay 


var^elay 


0% 


0.0262 


0.0019 


0.0262 


0.0019 


5% 


0.0205 


0.0019 


0.0259 


0.0022 


10% 


0.0096 


2.8933 X lO-'' 


0.0220 


0.0012 


15% 


0.0129 


7.7838 X 10-* 


0.0302 


0.0023 


20% 


0.0139 


7.7535 X 10-* 


0.0287 


0.0018 


30% 


0.0093 


5.6885 X 10-* 


0.0243 


0.0012 



TABLE IL The average and variance of p* with varying 6. We 

set m = 3, 71 = 10, ps = Pm+i.i — 10%, and padv = 10%. 



<5 


^adv 


VClfadv 


^relay 


var,.elay 



1 

2 
3 


0.0046 
0.0083 
0.0096 
0.0067 


3.8552 X 10-"* 
3.1523 X 10-* 
2.8933 X 10-* 
2.3491 X 10-* 


0.0071 
0.0120 
0.0220 
0.0240 


4.4103 X 10-* 
4.6351 X 10-* 

0.0012 

0.0015 



VL Simulations 

We present preliminary MATLAB simulation results that 
show the difference in distribution of p* between the well- 
behaving and adversarial relay. We consider a setup in Figure 
[ij We set all pn, i e [2, to] to be equal, and we denote 
this probability as ps = pn for all i. We denote padv to 
be the probability at which the adversary injects error; thus, 
the effective error that vi observes from an adversarial relay 
is combined effect of Pm+i.i and Padv The hash function 
h{x) = ax + b mod 2^ is randomly chosen over a,b £ Fj. 
We set n = 10; thus, the coding field size is 2^". For each 
data point, we run the algebraic watchdog 200 times. 

For simplicity, we assume that the nodes do not use an error- 
correcting code Cf, thus, di — for all i. Note that this limits 
the power of the algebraic watchdog; thus, the results shown 
can be further improved by using error correcting codes d. 

We denote p*^,, and p*giay as the value of p* when the relay 
is adversarial and is well-behaving, respectively. We denote 
varadv and var relay to be the variance of p*^„ and p*^i^y. 

Our simulation results coincide with our analysis and intu- 
ition. Section |IV] noted that vi can detect adversarial errors 
Padv > Pni+1,1- As shown in Table H] node vi is able to 
monitor its downstream node w„i+i when padv > Pm+i,i- 
There is a significant change in the distribution of p* once 
Padv > Pm+1.1 = 10%. Table HI] shows that increase in 
redundancy (by using hash functions of length 6) helps vi 
detect malicious behaviors. Note that for this simulation, 6 > 1 
gives enough redundancy for vi monitor Wm+i. 

Table [III] shows that overhearing channel between vi and 
Vi, i G [2, to] is important in detection. This agrees with our 
intuition - if node vi is able to infer better the messages 
Xi, the better its detection abilities. Thus, as the overhearing 
channel progressively worsens (ps increase), ui's ability to 
detect malicious behavior deteriorates, as shown in Table [III] 

In Table HV] we note the effect of to,. Node vi's ability to 
check Vm+i is reduced with m. When to increases, the number 
of messages to infer increases, which increases the uncertainty 
in the system. However, Table |IV] does not take into account 
that with increase in to, there are more u^'s, i € [l,m] that 



Ps 


Padv 


varadv 


Prelav 


varrelay 


5% 


0.0067 


6.3986 X 10-" 


0.0455 


0.0051 


10% 


0.0096 


2.8933 X 10-* 


0.0220 


0.0012 


20% 


0.0033 


4.9045 X 10-5 


0.0055 


7.3819 X 10-5 


30% 


0.0069 


1.6414 X 10-* 


0.0100 


8.5259 X 10-* 



TABLE IV: The average and variance of p* with varying m. 

We set n — 10, S = 2, Ps = Pm+is = 10%, and padv = 10%. 



m 


P'adv 


varadv 


^relay 


VaVrclay 


1 


0.0155 


0.0025 


0.1386 


0.0238 


2 


0.0087 


1.2932 X 10-* 


0.0225 


0.0011 


3 


0.0096 


2.8933 X 10"* 


0.0220 


0.0012 


4 


0.0082 


1.1902 X 10-* 


0.0136 


3.4301 X 10-* 


5 


0.0063 


4.1841 X 10-5 


0.0079 


5.2244 X 10-5 



perform checks on Vm+i independently. 

VII. Conclusions 

In this paper, we have proposed a multi-hop, multi-source 
algebraic watchdog, which allows network coded wireless 
systems to validate its information flows. A node monitors 
its downstream node by overhearing transmissions of its 
neighboring nodes; and uses the overheard information to infer 
what the behavior of its downstream node should be. Using 
the algebraic watchdog scheme, nodes can compute a proba- 
bihty of misbehavior, which can be used to detect malicious 
behavior Once a node has been identified as malicious, these 
nodes can either be punished/eliminated or excluded from the 
network by using reputation based schemes iJlllHl. 

We have provided a trellis-like graphical model for the 
detection inference process, and provided an algorithm that 
may be used to compute the probability that a downstream 
node is consistent with the overheard information. We have 
analytically shown how the size of hash function, minimum 
distance of the code used, as well as the overhearing channel 
quality can affect the probability of detection. Finally, we have 
presented preliminary simulation results that coincide with our 
analysis and intuition. 
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